From 2d9903e743fe84a25f17a85099f7d1760d13c944 Mon Sep 17 00:00:00 2001 From: Karel Zak Date: Thu, 8 Mar 2018 10:34:16 +0100 Subject: [PATCH 1/3] 2.30.2-2: fix #1552641 --- ...umount-use-findmnt-escape-a-space-in.patch | 44 +++++++++++++++++++ util-linux.spec | 6 +++ 2 files changed, 50 insertions(+) create mode 100644 0001-bash-completion-umount-use-findmnt-escape-a-space-in.patch diff --git a/0001-bash-completion-umount-use-findmnt-escape-a-space-in.patch b/0001-bash-completion-umount-use-findmnt-escape-a-space-in.patch new file mode 100644 index 0000000..acd4c53 --- /dev/null +++ b/0001-bash-completion-umount-use-findmnt-escape-a-space-in.patch @@ -0,0 +1,44 @@ +From 75f03badd7ed9f1dd951863d75e756883d3acc55 Mon Sep 17 00:00:00 2001 +From: Karel Zak +Date: Thu, 16 Nov 2017 16:27:32 +0100 +Subject: [PATCH] bash-completion: (umount) use findmnt, escape a space in + paths + + # mount /dev/sdc1 /mnt/test/foo\ bar + # umount + +has to return "/mnt/test/foo\ bar". + +Changes: + + * don't use mount | awk output, we have findmnt + * force compgen use \n as entries separator + +Addresses: https://github.com/karelzak/util-linux/issues/539 +Signed-off-by: Karel Zak +--- + bash-completion/umount | 9 +++++---- + 1 file changed, 5 insertions(+), 4 deletions(-) + +diff --git a/bash-completion/umount b/bash-completion/umount +index d76cb9fff..98c90d61a 100644 +--- a/bash-completion/umount ++++ b/bash-completion/umount +@@ -40,9 +40,10 @@ _umount_module() + return 0 + ;; + esac +- local DEVS_MPOINTS +- DEVS_MPOINTS="$(mount | awk '{print $1, $3}')" +- COMPREPLY=( $(compgen -W "$DEVS_MPOINTS" -- $cur) ) +- return 0 ++ ++ local oldifs=$IFS ++ IFS=$'\n' ++ COMPREPLY=( $( compgen -W '$(findmnt -lno TARGET | sed "s/\([[:blank:]]\)/\\\\\1/g")' -- "$cur" ) ) ++ IFS=$oldifs + } + complete -F _umount_module umount +-- +2.14.3 + diff --git a/util-linux.spec b/util-linux.spec index 29bca51..618db0e 100644 --- a/util-linux.spec +++ b/util-linux.spec @@ -89,6 +89,9 @@ Requires: libfdisk = %{version}-%{release} # 151635 - makeing /var/log/lastlog Patch0: 2.28-login-lastlog-create.patch +# 1552641 - CVE-2018-7738 util-linux: Shell command injection in unescaped bash-completed mount point names +Patch1: 0001-bash-completion-umount-use-findmnt-escape-a-space-in.patch + %description The util-linux package contains a large variety of low-level system utilities that are necessary for a Linux system to function. Among @@ -930,6 +933,9 @@ exit 0 %{_libdir}/python*/site-packages/libmount/* %changelog +* Thu Mar 8 2018 Karel Zak - 2.30.2-2 +- fix #1552641 - CVE-2018-7738 util-linux: Shell command injection in unescaped bash-completed mount point names + * Fri Sep 22 2017 Karel Zak - 2.30.2-1 - upgrade to v2.30.2 http://ftp.kernel.org/pub/linux/utils/util-linux/v2.30/v2.30.2-ReleaseNotes From 05aae355d472212484c578bb3edd848730ca822c Mon Sep 17 00:00:00 2001 From: Karel Zak Date: Thu, 8 Mar 2018 10:36:47 +0100 Subject: [PATCH 2/3] increment release number --- util-linux.spec | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/util-linux.spec b/util-linux.spec index 618db0e..e90d60c 100644 --- a/util-linux.spec +++ b/util-linux.spec @@ -2,7 +2,7 @@ Summary: A collection of basic system utilities Name: util-linux Version: 2.30.2 -Release: 1%{?dist} +Release: 2%{?dist} License: GPLv2 and GPLv2+ and LGPLv2+ and BSD with advertising and Public Domain Group: System Environment/Base URL: http://en.wikipedia.org/wiki/Util-linux From cafc6d2e51b82fd97d47f804919f6b50f63e54d4 Mon Sep 17 00:00:00 2001 From: Karel Zak Date: Tue, 27 Mar 2018 11:17:39 +0200 Subject: [PATCH 3/3] 2.30.2-3: fix #1560283 --- column-fix-leading-space-characters-bug.patch | 32 +++++++++++++++++++ util-linux.spec | 8 ++++- 2 files changed, 39 insertions(+), 1 deletion(-) create mode 100644 column-fix-leading-space-characters-bug.patch diff --git a/column-fix-leading-space-characters-bug.patch b/column-fix-leading-space-characters-bug.patch new file mode 100644 index 0000000..c4a88b5 --- /dev/null +++ b/column-fix-leading-space-characters-bug.patch @@ -0,0 +1,32 @@ +From 5b6fa6063990017f3384476537106caa9e3f5867 Mon Sep 17 00:00:00 2001 +From: Karel Zak +Date: Tue, 27 Mar 2018 10:40:13 +0200 +Subject: [PATCH] column: fix leading space characters bug + +The bug has been introduced during column(1) rewrite. The function +read_input() need to skip leading space only temporary to detect empty +lines, but the rest of the code has to use the original buffer (line). + +Addresses: https://github.com/karelzak/util-linux/issues/575 +Addresses: https://bugzilla.redhat.com/show_bug.cgi?id=1560283 +Signed-off-by: Karel Zak +--- + text-utils/column.c | 2 +- + 1 file changed, 1 insertion(+), 1 deletion(-) + +diff --git a/text-utils/column.c b/text-utils/column.c +index 5eb0de1ae..d6a6385e3 100644 +--- a/text-utils/column.c ++++ b/text-utils/column.c +@@ -452,7 +452,7 @@ static int read_input(struct column_control *ctl, FILE *fp) + if (!str || !*str) + continue; + +- wcs = mbs_to_wcs(str); ++ wcs = mbs_to_wcs(buf); + if (!wcs) + err(EXIT_FAILURE, _("read failed")); + +-- +2.14.3 + diff --git a/util-linux.spec b/util-linux.spec index e90d60c..8acd621 100644 --- a/util-linux.spec +++ b/util-linux.spec @@ -2,7 +2,7 @@ Summary: A collection of basic system utilities Name: util-linux Version: 2.30.2 -Release: 2%{?dist} +Release: 3%{?dist} License: GPLv2 and GPLv2+ and LGPLv2+ and BSD with advertising and Public Domain Group: System Environment/Base URL: http://en.wikipedia.org/wiki/Util-linux @@ -92,6 +92,9 @@ Patch0: 2.28-login-lastlog-create.patch # 1552641 - CVE-2018-7738 util-linux: Shell command injection in unescaped bash-completed mount point names Patch1: 0001-bash-completion-umount-use-findmnt-escape-a-space-in.patch +# 1560283 - column does not properly handle spaces at beginning of tab-separated table columns +Patch2: column-fix-leading-space-characters-bug.patch + %description The util-linux package contains a large variety of low-level system utilities that are necessary for a Linux system to function. Among @@ -933,6 +936,9 @@ exit 0 %{_libdir}/python*/site-packages/libmount/* %changelog +* Tue Mar 27 2018 Karel Zak - 2.30.2-3 +- fix #1560283 - column does not properly handle spaces at beginning of tab-separated table columns + * Thu Mar 8 2018 Karel Zak - 2.30.2-2 - fix #1552641 - CVE-2018-7738 util-linux: Shell command injection in unescaped bash-completed mount point names